Digitally safe & sound

Economic Times

19-05-2025

Dismissing a petition by PhonePe against a police notice related to a 2022 online sports betting investigation, Karnataka High Court recently ruled that digital payment intermediaries are not fully immune from disclosing users' confidential transaction details and account credentials in criminal cases. The ruling underscores the delicate balance between privacy, security and growth. How India navigates this terrain will shape civil liberties, and define its economic trajectory.
The 2017 Supreme Court judgment in 'Justice K S Puttaswamy (Retd) vs Union of India' recognised privacy as a fundamental right, aligning India with progressive global data protection standards and bolstering user confidence, a vital ingredient for digital commerce. But the apex court also stipulated that this right is not absolute, and must be harmonised with other compelling state interests.
To this end, the 'proportionality test' was established - a nuanced, 4-pronged framework requiring any state intrusion into privacy to: Have a legitimate aim.
Be necessary in a democratic society.
Be proportionate to the need.
Include robust procedural safeguards against abuse.
This test is a fulcrum upon which interests of individual liberty and collective security must be balanced, ensuring neither an anarchic digital space nor an overreaching surveillance state. For the digital economy, this framework promises predictability and fairness, both essential for attracting investment and fostering innovation. National security, undeniably, presents one of the most essential legitimate aims. In an era where digital platforms can be exploited for terrorism, sophisticated cyber warfare and large-scale economic fraud, the state's primary responsibility to protect its citizens and its economic stability is paramount.
Legislative tools such as Section 69 of the IT Act, enabling lawful interception, and Digital Personal Data Protection (DPDP) Act, reflect this pressing reality. DPDP Act, while aiming to create a data protection regime, rightly includes exemptions for processing personal data in the interest of India's sovereignty, security, public order, and prevention or investigation of offences. Such provisions are pragmatic necessities. The PhonePe case underscores this, affirming that while consumer privacy is vital, it cannot serve as an impenetrable shield for illicit activities that undermine the integrity of our financial systems.
Nevertheless, privacy advocates correctly argue that privacy and security are not adversarial. Robust privacy protections can, in fact, bolster security by shielding citizens from identity theft, financial scams, and the chilling effects of undue surveillance that can stifle innovation and free expression, the lifeblood of a dynamic digital economy.
The apprehension that expansive surveillance powers without stringent oversight could mirror the Orwellian state is a legitimate fear. An environment of perceived pervasive surveillance can erode public trust, discouraging participation in the digital economy and potentially driving data and talent to jurisdictions perceived as more rights-respecting.The optimal path forward, therefore, is not a binary choice between privacy and security, but a commitment to the proportionality principle. This means any restriction on privacy must be demonstrably necessary, narrowly tailored and subject to rigorous oversight.For India's digital economy, this translates into actionable imperatives: Necessity and specificity Surveillance must be a tool of last resort, targeted at genuine, identifiable threats, not a broad dragnet. This will ensure that most citizens and businesses can operate freely, fostering a climate of trust. Robust oversight mechanisms Independent judicial or parliamentary review of surveillance requests is crucial. Transparent, accountable oversight builds confidence that these powers are not being misused, which is essential for domestic and international business confidence. Data minimisation and purpose limitation Entities, both public and private, should collect necessary data and use it only for specified, legitimate purposes. This reduces the attack surface for breaches and limits the scope of potential government requests. Transparent frameworks While operational details of security measures must remain confidential, legal and procedural frameworks governing data access must be clear and publicly accessible. This predictability is key for businesses to navigate the regulatory landscape.Business leaders, innovators and stakeholders in India's growth story understand that a stable, predictable and rights-affirming regulatory environment is the bedrock of economic prosperity. When citizens trust that their data is protected and that state powers are exercised judiciously, they engage more readily in the digital marketplace. When businesses trust that the rules are clear and fairly-applied, they invest with greater confidence.Karnataka High Court's stance reflects the nuanced balancing act required. By diligently applying the proportionality framework, we can cultivate an ecosystem where privacy and security are not seen as conflicting forces, but as complementary pillars supporting a vibrant, secure and equitable digital future.
(The writer is former secretary,consumer affairs, GoI)